feat(middleware): Add middleware
This commit is contained in:
3
legalconsenthub-middleware/.gitattributes
vendored
Normal file
3
legalconsenthub-middleware/.gitattributes
vendored
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
/gradlew text eol=lf
|
||||||
|
*.bat text eol=crlf
|
||||||
|
*.jar binary
|
||||||
240
legalconsenthub-middleware/api/legalconsenthub-middleware.yml
Normal file
240
legalconsenthub-middleware/api/legalconsenthub-middleware.yml
Normal file
@@ -0,0 +1,240 @@
|
|||||||
|
openapi: "3.0.3"
|
||||||
|
info:
|
||||||
|
title: legalconsenthub-middleware
|
||||||
|
version: 0.1.0
|
||||||
|
description: Middleware for digital signature services using OpenSC pkcs11-tool for hash signing.
|
||||||
|
contact:
|
||||||
|
name: Denis Lugowski
|
||||||
|
email: denis.lugowski@gmail.com
|
||||||
|
|
||||||
|
servers:
|
||||||
|
- url: http://localhost:8081
|
||||||
|
|
||||||
|
security:
|
||||||
|
- bearerAuth: []
|
||||||
|
|
||||||
|
paths:
|
||||||
|
####### Smart Card Operations #######
|
||||||
|
/smart-card/info:
|
||||||
|
get:
|
||||||
|
summary: Get smart card information
|
||||||
|
operationId: getSmartCardInfo
|
||||||
|
tags:
|
||||||
|
- smart-card
|
||||||
|
responses:
|
||||||
|
"200":
|
||||||
|
description: Smart card information
|
||||||
|
content:
|
||||||
|
application/json:
|
||||||
|
schema:
|
||||||
|
$ref: "#/components/schemas/SmartCardInfoDto"
|
||||||
|
"400":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/BadRequest"
|
||||||
|
"401":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/Unauthorized"
|
||||||
|
"404":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/NotFound"
|
||||||
|
"500":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServerError"
|
||||||
|
"503":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServiceUnavailable"
|
||||||
|
|
||||||
|
/smart-card/certificates:
|
||||||
|
get:
|
||||||
|
summary: Get available certificates on smart card
|
||||||
|
operationId: getSmartCardCertificates
|
||||||
|
tags:
|
||||||
|
- smart-card
|
||||||
|
responses:
|
||||||
|
"200":
|
||||||
|
description: List of available certificates
|
||||||
|
content:
|
||||||
|
application/json:
|
||||||
|
schema:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
$ref: "#/components/schemas/CertificateDto"
|
||||||
|
"400":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/BadRequest"
|
||||||
|
"401":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/Unauthorized"
|
||||||
|
"404":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/NotFound"
|
||||||
|
"500":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServerError"
|
||||||
|
"503":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServiceUnavailable"
|
||||||
|
|
||||||
|
####### PDF Hash Signing Operations #######
|
||||||
|
/sign-pdf-hash:
|
||||||
|
post:
|
||||||
|
summary: Calculate hash from PDF and sign it using smart card
|
||||||
|
operationId: signPdfHash
|
||||||
|
tags:
|
||||||
|
- signature
|
||||||
|
requestBody:
|
||||||
|
required: true
|
||||||
|
content:
|
||||||
|
multipart/form-data:
|
||||||
|
schema:
|
||||||
|
$ref: "#/components/schemas/SignPdfHashRequestDto"
|
||||||
|
responses:
|
||||||
|
"200":
|
||||||
|
description: Base64 encoded signature
|
||||||
|
content:
|
||||||
|
text/plain:
|
||||||
|
schema:
|
||||||
|
type: string
|
||||||
|
description: Base64 encoded signature
|
||||||
|
"400":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/BadRequest"
|
||||||
|
"401":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/Unauthorized"
|
||||||
|
"404":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/NotFound"
|
||||||
|
"500":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServerError"
|
||||||
|
"503":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServiceUnavailable"
|
||||||
|
|
||||||
|
/verify-signature:
|
||||||
|
post:
|
||||||
|
summary: Verify a signature against a document
|
||||||
|
operationId: verifySignature
|
||||||
|
tags:
|
||||||
|
- signature
|
||||||
|
requestBody:
|
||||||
|
required: true
|
||||||
|
content:
|
||||||
|
multipart/form-data:
|
||||||
|
schema:
|
||||||
|
$ref: "#/components/schemas/VerifySignatureRequestDto"
|
||||||
|
responses:
|
||||||
|
"200":
|
||||||
|
description: Signature verification result
|
||||||
|
content:
|
||||||
|
application/json:
|
||||||
|
schema:
|
||||||
|
$ref: "#/components/schemas/VerifySignatureResponseDto"
|
||||||
|
"400":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/BadRequest"
|
||||||
|
"401":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/Unauthorized"
|
||||||
|
"404":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/NotFound"
|
||||||
|
"500":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServerError"
|
||||||
|
"503":
|
||||||
|
$ref: "https://api.swaggerhub.com/domains/smartbear-public/ProblemDetails/1.0.0#/components/responses/ServiceUnavailable"
|
||||||
|
|
||||||
|
components:
|
||||||
|
securitySchemes:
|
||||||
|
bearerAuth:
|
||||||
|
type: http
|
||||||
|
scheme: bearer
|
||||||
|
bearerFormat: JWT
|
||||||
|
|
||||||
|
schemas:
|
||||||
|
####### Smart Card DTOs #######
|
||||||
|
SmartCardInfoDto:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- isPresent
|
||||||
|
- label
|
||||||
|
properties:
|
||||||
|
isPresent:
|
||||||
|
type: boolean
|
||||||
|
label:
|
||||||
|
type: string
|
||||||
|
serialNumber:
|
||||||
|
type: string
|
||||||
|
manufacturer:
|
||||||
|
type: string
|
||||||
|
model:
|
||||||
|
type: string
|
||||||
|
|
||||||
|
CertificateDto:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- id
|
||||||
|
- subject
|
||||||
|
- issuer
|
||||||
|
- validFrom
|
||||||
|
- validTo
|
||||||
|
- keyUsage
|
||||||
|
properties:
|
||||||
|
id:
|
||||||
|
type: string
|
||||||
|
subject:
|
||||||
|
type: string
|
||||||
|
issuer:
|
||||||
|
type: string
|
||||||
|
validFrom:
|
||||||
|
type: string
|
||||||
|
format: date-time
|
||||||
|
validTo:
|
||||||
|
type: string
|
||||||
|
format: date-time
|
||||||
|
keyUsage:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
fingerprint:
|
||||||
|
type: string
|
||||||
|
|
||||||
|
####### PDF Hash Signing DTOs #######
|
||||||
|
SignPdfHashRequestDto:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- document
|
||||||
|
- certificateId
|
||||||
|
properties:
|
||||||
|
document:
|
||||||
|
type: string
|
||||||
|
format: binary
|
||||||
|
description: PDF document to calculate hash from
|
||||||
|
certificateId:
|
||||||
|
type: string
|
||||||
|
description: ID of the certificate to use for signing
|
||||||
|
hashAlgorithm:
|
||||||
|
type: string
|
||||||
|
enum: [SHA1, SHA256, SHA384, SHA512]
|
||||||
|
default: SHA256
|
||||||
|
description: Hash algorithm to use
|
||||||
|
|
||||||
|
VerifySignatureRequestDto:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- document
|
||||||
|
- signature
|
||||||
|
properties:
|
||||||
|
document:
|
||||||
|
type: string
|
||||||
|
format: binary
|
||||||
|
description: Document to verify signature against
|
||||||
|
signature:
|
||||||
|
type: string
|
||||||
|
description: Base64 encoded signature to verify
|
||||||
|
certificateId:
|
||||||
|
type: string
|
||||||
|
description: ID of the certificate to use for verification (optional, will use embedded certificate if not provided)
|
||||||
|
hashAlgorithm:
|
||||||
|
type: string
|
||||||
|
enum: [SHA1, SHA256, SHA384, SHA512]
|
||||||
|
default: SHA256
|
||||||
|
description: Hash algorithm used for verification
|
||||||
|
|
||||||
|
VerifySignatureResponseDto:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- isValid
|
||||||
|
properties:
|
||||||
|
isValid:
|
||||||
|
type: boolean
|
||||||
|
description: Whether the signature is valid
|
||||||
|
certificateInfo:
|
||||||
|
$ref: "#/components/schemas/CertificateDto"
|
||||||
|
description: Information about the certificate used for signing
|
||||||
|
verificationDetails:
|
||||||
|
type: string
|
||||||
|
description: Additional details about the verification process
|
||||||
66
legalconsenthub-middleware/build.gradle
Normal file
66
legalconsenthub-middleware/build.gradle
Normal file
@@ -0,0 +1,66 @@
|
|||||||
|
plugins {
|
||||||
|
id 'org.jetbrains.kotlin.jvm' version '1.9.25'
|
||||||
|
id 'org.jetbrains.kotlin.plugin.spring' version '1.9.25'
|
||||||
|
id 'org.springframework.boot' version '3.5.3'
|
||||||
|
id 'io.spring.dependency-management' version '1.1.7'
|
||||||
|
id 'org.openapi.generator' version '7.11.0'
|
||||||
|
}
|
||||||
|
|
||||||
|
group = 'com.betriebsratkanzlei'
|
||||||
|
version = '0.0.1-SNAPSHOT'
|
||||||
|
|
||||||
|
java {
|
||||||
|
toolchain {
|
||||||
|
languageVersion = JavaLanguageVersion.of(21)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
repositories {
|
||||||
|
mavenCentral()
|
||||||
|
}
|
||||||
|
|
||||||
|
dependencies {
|
||||||
|
implementation 'org.springframework.boot:spring-boot-starter-web'
|
||||||
|
implementation 'com.fasterxml.jackson.module:jackson-module-kotlin'
|
||||||
|
implementation 'org.jetbrains.kotlin:kotlin-reflect'
|
||||||
|
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6'
|
||||||
|
implementation 'org.springdoc:springdoc-openapi-ui:1.8.0'
|
||||||
|
|
||||||
|
// Apache commons for file operations and process execution
|
||||||
|
implementation 'commons-io:commons-io:2.17.0'
|
||||||
|
implementation 'org.apache.commons:commons-exec:1.4.0'
|
||||||
|
|
||||||
|
developmentOnly 'org.springframework.boot:spring-boot-devtools'
|
||||||
|
}
|
||||||
|
|
||||||
|
kotlin {
|
||||||
|
compilerOptions {
|
||||||
|
freeCompilerArgs.addAll '-Xjsr305=strict'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
def generatedSourcesServerMiddlewareDir = "$buildDir/generated/server".toString()
|
||||||
|
|
||||||
|
sourceSets {
|
||||||
|
main {
|
||||||
|
kotlin.srcDirs += generatedSourcesServerMiddlewareDir + '/src/main/kotlin'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
task generate_middleware_server(type: org.openapitools.generator.gradle.plugin.tasks.GenerateTask) {
|
||||||
|
generatorName = 'kotlin-spring'
|
||||||
|
inputSpec = "$rootDir/api/legalconsenthub-middleware.yml".toString()
|
||||||
|
outputDir = generatedSourcesServerMiddlewareDir
|
||||||
|
apiPackage = 'com.betriebsratkanzlei.legalconsenthub_middleware_api.api'
|
||||||
|
modelPackage = 'com.betriebsratkanzlei.legalconsenthub_middleware_api.model'
|
||||||
|
groupId = 'com.betriebsratkanzlei'
|
||||||
|
id = 'legalconsenthub_middleware_api'
|
||||||
|
configOptions = [useTags : 'true',
|
||||||
|
enumPropertyNaming: 'original',
|
||||||
|
interfaceOnly : 'true',
|
||||||
|
useSpringBoot3 : 'true']
|
||||||
|
typeMappings = [DateTime: "LocalDateTime"]
|
||||||
|
importMappings = [LocalDateTime: "java.time.LocalDateTime"]
|
||||||
|
}
|
||||||
|
|
||||||
|
compileKotlin.dependsOn(tasks.generate_middleware_server)
|
||||||
BIN
legalconsenthub-middleware/gradle/wrapper/gradle-wrapper.jar
vendored
Normal file
BIN
legalconsenthub-middleware/gradle/wrapper/gradle-wrapper.jar
vendored
Normal file
Binary file not shown.
7
legalconsenthub-middleware/gradle/wrapper/gradle-wrapper.properties
vendored
Normal file
7
legalconsenthub-middleware/gradle/wrapper/gradle-wrapper.properties
vendored
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
distributionBase=GRADLE_USER_HOME
|
||||||
|
distributionPath=wrapper/dists
|
||||||
|
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.2-bin.zip
|
||||||
|
networkTimeout=10000
|
||||||
|
validateDistributionUrl=true
|
||||||
|
zipStoreBase=GRADLE_USER_HOME
|
||||||
|
zipStorePath=wrapper/dists
|
||||||
251
legalconsenthub-middleware/gradlew
vendored
Executable file
251
legalconsenthub-middleware/gradlew
vendored
Executable file
@@ -0,0 +1,251 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
#
|
||||||
|
# Copyright © 2015-2021 the original authors.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
#
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Gradle start up script for POSIX generated by Gradle.
|
||||||
|
#
|
||||||
|
# Important for running:
|
||||||
|
#
|
||||||
|
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
|
||||||
|
# noncompliant, but you have some other compliant shell such as ksh or
|
||||||
|
# bash, then to run this script, type that shell name before the whole
|
||||||
|
# command line, like:
|
||||||
|
#
|
||||||
|
# ksh Gradle
|
||||||
|
#
|
||||||
|
# Busybox and similar reduced shells will NOT work, because this script
|
||||||
|
# requires all of these POSIX shell features:
|
||||||
|
# * functions;
|
||||||
|
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
|
||||||
|
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
|
||||||
|
# * compound commands having a testable exit status, especially «case»;
|
||||||
|
# * various built-in commands including «command», «set», and «ulimit».
|
||||||
|
#
|
||||||
|
# Important for patching:
|
||||||
|
#
|
||||||
|
# (2) This script targets any POSIX shell, so it avoids extensions provided
|
||||||
|
# by Bash, Ksh, etc; in particular arrays are avoided.
|
||||||
|
#
|
||||||
|
# The "traditional" practice of packing multiple parameters into a
|
||||||
|
# space-separated string is a well documented source of bugs and security
|
||||||
|
# problems, so this is (mostly) avoided, by progressively accumulating
|
||||||
|
# options in "$@", and eventually passing that to Java.
|
||||||
|
#
|
||||||
|
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
|
||||||
|
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
|
||||||
|
# see the in-line comments for details.
|
||||||
|
#
|
||||||
|
# There are tweaks for specific operating systems such as AIX, CygWin,
|
||||||
|
# Darwin, MinGW, and NonStop.
|
||||||
|
#
|
||||||
|
# (3) This script is generated from the Groovy template
|
||||||
|
# https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
|
||||||
|
# within the Gradle project.
|
||||||
|
#
|
||||||
|
# You can find Gradle at https://github.com/gradle/gradle/.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
# Attempt to set APP_HOME
|
||||||
|
|
||||||
|
# Resolve links: $0 may be a link
|
||||||
|
app_path=$0
|
||||||
|
|
||||||
|
# Need this for daisy-chained symlinks.
|
||||||
|
while
|
||||||
|
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
|
||||||
|
[ -h "$app_path" ]
|
||||||
|
do
|
||||||
|
ls=$( ls -ld "$app_path" )
|
||||||
|
link=${ls#*' -> '}
|
||||||
|
case $link in #(
|
||||||
|
/*) app_path=$link ;; #(
|
||||||
|
*) app_path=$APP_HOME$link ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
# This is normally unused
|
||||||
|
# shellcheck disable=SC2034
|
||||||
|
APP_BASE_NAME=${0##*/}
|
||||||
|
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
|
||||||
|
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
|
||||||
|
|
||||||
|
# Use the maximum available, or set MAX_FD != -1 to use that value.
|
||||||
|
MAX_FD=maximum
|
||||||
|
|
||||||
|
warn () {
|
||||||
|
echo "$*"
|
||||||
|
} >&2
|
||||||
|
|
||||||
|
die () {
|
||||||
|
echo
|
||||||
|
echo "$*"
|
||||||
|
echo
|
||||||
|
exit 1
|
||||||
|
} >&2
|
||||||
|
|
||||||
|
# OS specific support (must be 'true' or 'false').
|
||||||
|
cygwin=false
|
||||||
|
msys=false
|
||||||
|
darwin=false
|
||||||
|
nonstop=false
|
||||||
|
case "$( uname )" in #(
|
||||||
|
CYGWIN* ) cygwin=true ;; #(
|
||||||
|
Darwin* ) darwin=true ;; #(
|
||||||
|
MSYS* | MINGW* ) msys=true ;; #(
|
||||||
|
NONSTOP* ) nonstop=true ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
CLASSPATH="\\\"\\\""
|
||||||
|
|
||||||
|
|
||||||
|
# Determine the Java command to use to start the JVM.
|
||||||
|
if [ -n "$JAVA_HOME" ] ; then
|
||||||
|
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
|
||||||
|
# IBM's JDK on AIX uses strange locations for the executables
|
||||||
|
JAVACMD=$JAVA_HOME/jre/sh/java
|
||||||
|
else
|
||||||
|
JAVACMD=$JAVA_HOME/bin/java
|
||||||
|
fi
|
||||||
|
if [ ! -x "$JAVACMD" ] ; then
|
||||||
|
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
|
||||||
|
|
||||||
|
Please set the JAVA_HOME variable in your environment to match the
|
||||||
|
location of your Java installation."
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
JAVACMD=java
|
||||||
|
if ! command -v java >/dev/null 2>&1
|
||||||
|
then
|
||||||
|
die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
||||||
|
|
||||||
|
Please set the JAVA_HOME variable in your environment to match the
|
||||||
|
location of your Java installation."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Increase the maximum file descriptors if we can.
|
||||||
|
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
|
||||||
|
case $MAX_FD in #(
|
||||||
|
max*)
|
||||||
|
# In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
|
||||||
|
# shellcheck disable=SC2039,SC3045
|
||||||
|
MAX_FD=$( ulimit -H -n ) ||
|
||||||
|
warn "Could not query maximum file descriptor limit"
|
||||||
|
esac
|
||||||
|
case $MAX_FD in #(
|
||||||
|
'' | soft) :;; #(
|
||||||
|
*)
|
||||||
|
# In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
|
||||||
|
# shellcheck disable=SC2039,SC3045
|
||||||
|
ulimit -n "$MAX_FD" ||
|
||||||
|
warn "Could not set maximum file descriptor limit to $MAX_FD"
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Collect all arguments for the java command, stacking in reverse order:
|
||||||
|
# * args from the command line
|
||||||
|
# * the main class name
|
||||||
|
# * -classpath
|
||||||
|
# * -D...appname settings
|
||||||
|
# * --module-path (only if needed)
|
||||||
|
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
|
||||||
|
|
||||||
|
# For Cygwin or MSYS, switch paths to Windows format before running java
|
||||||
|
if "$cygwin" || "$msys" ; then
|
||||||
|
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
|
||||||
|
CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
|
||||||
|
|
||||||
|
JAVACMD=$( cygpath --unix "$JAVACMD" )
|
||||||
|
|
||||||
|
# Now convert the arguments - kludge to limit ourselves to /bin/sh
|
||||||
|
for arg do
|
||||||
|
if
|
||||||
|
case $arg in #(
|
||||||
|
-*) false ;; # don't mess with options #(
|
||||||
|
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
|
||||||
|
[ -e "$t" ] ;; #(
|
||||||
|
*) false ;;
|
||||||
|
esac
|
||||||
|
then
|
||||||
|
arg=$( cygpath --path --ignore --mixed "$arg" )
|
||||||
|
fi
|
||||||
|
# Roll the args list around exactly as many times as the number of
|
||||||
|
# args, so each arg winds up back in the position where it started, but
|
||||||
|
# possibly modified.
|
||||||
|
#
|
||||||
|
# NB: a `for` loop captures its iteration list before it begins, so
|
||||||
|
# changing the positional parameters here affects neither the number of
|
||||||
|
# iterations, nor the values presented in `arg`.
|
||||||
|
shift # remove old arg
|
||||||
|
set -- "$@" "$arg" # push replacement arg
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||||
|
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
|
||||||
|
|
||||||
|
# Collect all arguments for the java command:
|
||||||
|
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
|
||||||
|
# and any embedded shellness will be escaped.
|
||||||
|
# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
|
||||||
|
# treated as '${Hostname}' itself on the command line.
|
||||||
|
|
||||||
|
set -- \
|
||||||
|
"-Dorg.gradle.appname=$APP_BASE_NAME" \
|
||||||
|
-classpath "$CLASSPATH" \
|
||||||
|
-jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
|
||||||
|
"$@"
|
||||||
|
|
||||||
|
# Stop when "xargs" is not available.
|
||||||
|
if ! command -v xargs >/dev/null 2>&1
|
||||||
|
then
|
||||||
|
die "xargs is not available"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Use "xargs" to parse quoted args.
|
||||||
|
#
|
||||||
|
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
|
||||||
|
#
|
||||||
|
# In Bash we could simply go:
|
||||||
|
#
|
||||||
|
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
|
||||||
|
# set -- "${ARGS[@]}" "$@"
|
||||||
|
#
|
||||||
|
# but POSIX shell has neither arrays nor command substitution, so instead we
|
||||||
|
# post-process each arg (as a line of input to sed) to backslash-escape any
|
||||||
|
# character that might be a shell metacharacter, then use eval to reverse
|
||||||
|
# that process (while maintaining the separation between arguments), and wrap
|
||||||
|
# the whole thing up as a single "set" statement.
|
||||||
|
#
|
||||||
|
# This will of course break if any of these variables contains a newline or
|
||||||
|
# an unmatched quote.
|
||||||
|
#
|
||||||
|
|
||||||
|
eval "set -- $(
|
||||||
|
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
|
||||||
|
xargs -n1 |
|
||||||
|
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
|
||||||
|
tr '\n' ' '
|
||||||
|
)" '"$@"'
|
||||||
|
|
||||||
|
exec "$JAVACMD" "$@"
|
||||||
94
legalconsenthub-middleware/gradlew.bat
vendored
Normal file
94
legalconsenthub-middleware/gradlew.bat
vendored
Normal file
@@ -0,0 +1,94 @@
|
|||||||
|
@rem
|
||||||
|
@rem Copyright 2015 the original author or authors.
|
||||||
|
@rem
|
||||||
|
@rem Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
@rem you may not use this file except in compliance with the License.
|
||||||
|
@rem You may obtain a copy of the License at
|
||||||
|
@rem
|
||||||
|
@rem https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
@rem
|
||||||
|
@rem Unless required by applicable law or agreed to in writing, software
|
||||||
|
@rem distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
@rem See the License for the specific language governing permissions and
|
||||||
|
@rem limitations under the License.
|
||||||
|
@rem
|
||||||
|
@rem SPDX-License-Identifier: Apache-2.0
|
||||||
|
@rem
|
||||||
|
|
||||||
|
@if "%DEBUG%"=="" @echo off
|
||||||
|
@rem ##########################################################################
|
||||||
|
@rem
|
||||||
|
@rem Gradle startup script for Windows
|
||||||
|
@rem
|
||||||
|
@rem ##########################################################################
|
||||||
|
|
||||||
|
@rem Set local scope for the variables with windows NT shell
|
||||||
|
if "%OS%"=="Windows_NT" setlocal
|
||||||
|
|
||||||
|
set DIRNAME=%~dp0
|
||||||
|
if "%DIRNAME%"=="" set DIRNAME=.
|
||||||
|
@rem This is normally unused
|
||||||
|
set APP_BASE_NAME=%~n0
|
||||||
|
set APP_HOME=%DIRNAME%
|
||||||
|
|
||||||
|
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
|
||||||
|
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
|
||||||
|
|
||||||
|
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||||
|
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
|
||||||
|
|
||||||
|
@rem Find java.exe
|
||||||
|
if defined JAVA_HOME goto findJavaFromJavaHome
|
||||||
|
|
||||||
|
set JAVA_EXE=java.exe
|
||||||
|
%JAVA_EXE% -version >NUL 2>&1
|
||||||
|
if %ERRORLEVEL% equ 0 goto execute
|
||||||
|
|
||||||
|
echo. 1>&2
|
||||||
|
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
|
||||||
|
echo. 1>&2
|
||||||
|
echo Please set the JAVA_HOME variable in your environment to match the 1>&2
|
||||||
|
echo location of your Java installation. 1>&2
|
||||||
|
|
||||||
|
goto fail
|
||||||
|
|
||||||
|
:findJavaFromJavaHome
|
||||||
|
set JAVA_HOME=%JAVA_HOME:"=%
|
||||||
|
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
|
||||||
|
|
||||||
|
if exist "%JAVA_EXE%" goto execute
|
||||||
|
|
||||||
|
echo. 1>&2
|
||||||
|
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
|
||||||
|
echo. 1>&2
|
||||||
|
echo Please set the JAVA_HOME variable in your environment to match the 1>&2
|
||||||
|
echo location of your Java installation. 1>&2
|
||||||
|
|
||||||
|
goto fail
|
||||||
|
|
||||||
|
:execute
|
||||||
|
@rem Setup the command line
|
||||||
|
|
||||||
|
set CLASSPATH=
|
||||||
|
|
||||||
|
|
||||||
|
@rem Execute Gradle
|
||||||
|
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
|
||||||
|
|
||||||
|
:end
|
||||||
|
@rem End local scope for the variables with windows NT shell
|
||||||
|
if %ERRORLEVEL% equ 0 goto mainEnd
|
||||||
|
|
||||||
|
:fail
|
||||||
|
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
|
||||||
|
rem the _cmd.exe /c_ return code!
|
||||||
|
set EXIT_CODE=%ERRORLEVEL%
|
||||||
|
if %EXIT_CODE% equ 0 set EXIT_CODE=1
|
||||||
|
if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
|
||||||
|
exit /b %EXIT_CODE%
|
||||||
|
|
||||||
|
:mainEnd
|
||||||
|
if "%OS%"=="Windows_NT" endlocal
|
||||||
|
|
||||||
|
:omega
|
||||||
1
legalconsenthub-middleware/settings.gradle
Normal file
1
legalconsenthub-middleware/settings.gradle
Normal file
@@ -0,0 +1 @@
|
|||||||
|
rootProject.name = 'legalconsenthub-middleware'
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware
|
||||||
|
|
||||||
|
import org.springframework.boot.autoconfigure.SpringBootApplication
|
||||||
|
import org.springframework.boot.runApplication
|
||||||
|
|
||||||
|
@SpringBootApplication
|
||||||
|
class LegalconsenthubMiddlewareApplication
|
||||||
|
|
||||||
|
fun main(args: Array<String>) {
|
||||||
|
runApplication<LegalconsenthubMiddlewareApplication>(*args)
|
||||||
|
}
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.exception
|
||||||
|
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware.smartcard.SmartCardNotFoundException
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware.smartcard.SmartCardReadException
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware.smartcard.SmartCardUnavailableException
|
||||||
|
import org.springframework.http.HttpStatus
|
||||||
|
import org.springframework.http.ResponseEntity
|
||||||
|
import org.springframework.web.bind.annotation.ExceptionHandler
|
||||||
|
import org.springframework.web.bind.annotation.RestControllerAdvice
|
||||||
|
import java.time.Instant
|
||||||
|
|
||||||
|
@RestControllerAdvice
|
||||||
|
class GlobalExceptionHandler {
|
||||||
|
|
||||||
|
@ExceptionHandler(SmartCardNotFoundException::class)
|
||||||
|
fun handleSmartCardNotFoundException(ex: SmartCardNotFoundException): ResponseEntity<Map<String, Any>> {
|
||||||
|
val problem = mutableMapOf<String, Any>()
|
||||||
|
problem["type"] = "https://problems-registry.smartbear.com/not-found"
|
||||||
|
problem["title"] = "Smart Card Not Found"
|
||||||
|
problem["status"] = HttpStatus.NOT_FOUND.value()
|
||||||
|
problem["detail"] = ex.message ?: "Smart card not found"
|
||||||
|
problem["instance"] = "/smart-card/info"
|
||||||
|
problem["timestamp"] = Instant.now().toString()
|
||||||
|
|
||||||
|
return ResponseEntity.status(HttpStatus.NOT_FOUND)
|
||||||
|
.header("Content-Type", "application/problem+json")
|
||||||
|
.body(problem)
|
||||||
|
}
|
||||||
|
|
||||||
|
@ExceptionHandler(SmartCardReadException::class)
|
||||||
|
fun handleSmartCardReadException(ex: SmartCardReadException): ResponseEntity<Map<String, Any>> {
|
||||||
|
val problem = mutableMapOf<String, Any>()
|
||||||
|
problem["type"] = "https://problems-registry.smartbear.com/server-error"
|
||||||
|
problem["title"] = "Smart Card Read Error"
|
||||||
|
problem["status"] = HttpStatus.INTERNAL_SERVER_ERROR.value()
|
||||||
|
problem["detail"] = ex.message ?: "Error reading smart card"
|
||||||
|
problem["instance"] = "/smart-card/info"
|
||||||
|
problem["timestamp"] = Instant.now().toString()
|
||||||
|
|
||||||
|
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
|
||||||
|
.header("Content-Type", "application/problem+json")
|
||||||
|
.body(problem)
|
||||||
|
}
|
||||||
|
|
||||||
|
@ExceptionHandler(SmartCardUnavailableException::class)
|
||||||
|
fun handleSmartCardUnavailableException(ex: SmartCardUnavailableException): ResponseEntity<Map<String, Any>> {
|
||||||
|
val problem = mutableMapOf<String, Any>()
|
||||||
|
problem["type"] = "https://problems-registry.smartbear.com/service-unavailable"
|
||||||
|
problem["title"] = "Smart Card Service Unavailable"
|
||||||
|
problem["status"] = HttpStatus.SERVICE_UNAVAILABLE.value()
|
||||||
|
problem["detail"] = ex.message ?: "Smart card service unavailable"
|
||||||
|
problem["instance"] = "/smart-card/info"
|
||||||
|
problem["timestamp"] = Instant.now().toString()
|
||||||
|
|
||||||
|
return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE)
|
||||||
|
.header("Content-Type", "application/problem+json")
|
||||||
|
.body(problem)
|
||||||
|
}
|
||||||
|
|
||||||
|
@ExceptionHandler(Exception::class)
|
||||||
|
fun handleGenericException(ex: Exception): ResponseEntity<Map<String, Any>> {
|
||||||
|
val problem = mutableMapOf<String, Any>()
|
||||||
|
problem["type"] = "about:blank"
|
||||||
|
problem["title"] = "Internal Server Error"
|
||||||
|
problem["status"] = HttpStatus.INTERNAL_SERVER_ERROR.value()
|
||||||
|
problem["detail"] = "An unexpected error occurred: ${ex.message ?: "Unknown error"}"
|
||||||
|
problem["timestamp"] = Instant.now().toString()
|
||||||
|
|
||||||
|
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
|
||||||
|
.header("Content-Type", "application/problem+json")
|
||||||
|
.body(problem)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.signature
|
||||||
|
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.api.SignatureApi
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.VerifySignatureResponseDto
|
||||||
|
import org.springframework.http.ResponseEntity
|
||||||
|
import org.springframework.web.bind.annotation.RestController
|
||||||
|
import org.springframework.web.multipart.MultipartFile
|
||||||
|
|
||||||
|
@RestController
|
||||||
|
class SignatureController(
|
||||||
|
private val signatureService: SignatureService
|
||||||
|
) : SignatureApi {
|
||||||
|
|
||||||
|
override fun signPdfHash(
|
||||||
|
document: MultipartFile,
|
||||||
|
certificateId: String,
|
||||||
|
hashAlgorithm: String
|
||||||
|
): ResponseEntity<String> {
|
||||||
|
val signature = signatureService.signPdfHash(
|
||||||
|
document = document.bytes,
|
||||||
|
certificateId = certificateId,
|
||||||
|
hashAlgorithm = hashAlgorithm
|
||||||
|
)
|
||||||
|
return ResponseEntity.ok(signature)
|
||||||
|
}
|
||||||
|
|
||||||
|
override fun verifySignature(
|
||||||
|
document: MultipartFile,
|
||||||
|
signature: String,
|
||||||
|
certificateId: String?,
|
||||||
|
hashAlgorithm: String
|
||||||
|
): ResponseEntity<VerifySignatureResponseDto> {
|
||||||
|
val verificationResult = signatureService.verifySignature(
|
||||||
|
document = document.bytes,
|
||||||
|
signature = signature,
|
||||||
|
certificateId = certificateId,
|
||||||
|
hashAlgorithm = hashAlgorithm
|
||||||
|
)
|
||||||
|
return ResponseEntity.ok(verificationResult)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.signature
|
||||||
|
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware.smartcard.SmartCardService
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.VerifySignatureResponseDto
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.CertificateDto
|
||||||
|
import org.springframework.stereotype.Service
|
||||||
|
import java.util.*
|
||||||
|
|
||||||
|
@Service
|
||||||
|
class SignatureService(
|
||||||
|
private val smartCardService: SmartCardService
|
||||||
|
) {
|
||||||
|
|
||||||
|
fun signPdfHash(
|
||||||
|
document: ByteArray,
|
||||||
|
certificateId: String,
|
||||||
|
hashAlgorithm: String
|
||||||
|
): String {
|
||||||
|
val hashBase64 = smartCardService.calculateHash(document, hashAlgorithm)
|
||||||
|
|
||||||
|
val certificates = smartCardService.getSmartCardCertificates()
|
||||||
|
certificates.find { it.id == certificateId }
|
||||||
|
?: throw IllegalArgumentException("Certificate not found: $certificateId")
|
||||||
|
|
||||||
|
// Sign the hash using smart card (PIN will be entered on device)
|
||||||
|
return smartCardService.signHash(hashBase64, certificateId)
|
||||||
|
}
|
||||||
|
|
||||||
|
fun verifySignature(
|
||||||
|
document: ByteArray,
|
||||||
|
signature: String,
|
||||||
|
certificateId: String?,
|
||||||
|
hashAlgorithm: String
|
||||||
|
): VerifySignatureResponseDto {
|
||||||
|
try {
|
||||||
|
val certificates = smartCardService.getSmartCardCertificates()
|
||||||
|
val certificate = if (certificateId != null) {
|
||||||
|
certificates.find { it.id == certificateId }
|
||||||
|
?: throw IllegalArgumentException("Certificate not found: $certificateId")
|
||||||
|
} else {
|
||||||
|
// If no specific certificate ID provided, try to find the certificate from the signature
|
||||||
|
// For now, we'll use the first available certificate
|
||||||
|
certificates.firstOrNull()
|
||||||
|
?: throw IllegalArgumentException("No certificates available for verification")
|
||||||
|
}
|
||||||
|
|
||||||
|
val isValid = smartCardService.verifySignature(document, signature, certificate.id, hashAlgorithm)
|
||||||
|
|
||||||
|
return VerifySignatureResponseDto(
|
||||||
|
isValid = isValid,
|
||||||
|
certificateInfo = certificate,
|
||||||
|
verificationDetails = "Signature verified using pkcs11-tool with ${hashAlgorithm} algorithm"
|
||||||
|
)
|
||||||
|
|
||||||
|
} catch (e: Exception) {
|
||||||
|
return VerifySignatureResponseDto(
|
||||||
|
isValid = false,
|
||||||
|
certificateInfo = null,
|
||||||
|
verificationDetails = "Verification failed: ${e.message}"
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.smartcard
|
||||||
|
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.api.SmartCardApi
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.CertificateDto
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.SmartCardInfoDto
|
||||||
|
import org.springframework.http.ResponseEntity
|
||||||
|
import org.springframework.web.bind.annotation.RestController
|
||||||
|
import java.time.LocalDateTime
|
||||||
|
|
||||||
|
@RestController
|
||||||
|
class SmartCardController(
|
||||||
|
private val smartCardService: SmartCardService
|
||||||
|
) : SmartCardApi {
|
||||||
|
|
||||||
|
override fun getSmartCardInfo(): ResponseEntity<SmartCardInfoDto> {
|
||||||
|
val smartCardInfo = smartCardService.getSmartCardInfo()
|
||||||
|
return ResponseEntity.ok(smartCardInfo)
|
||||||
|
}
|
||||||
|
|
||||||
|
override fun getSmartCardCertificates(): ResponseEntity<List<CertificateDto>> {
|
||||||
|
val certificates = smartCardService.getSmartCardCertificates()
|
||||||
|
return ResponseEntity.ok(certificates)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.smartcard
|
||||||
|
|
||||||
|
class SmartCardNotFoundException(message: String) : RuntimeException(message)
|
||||||
|
class SmartCardReadException(message: String, cause: Throwable? = null) : RuntimeException(message, cause)
|
||||||
|
class SmartCardUnavailableException(message: String) : RuntimeException(message)
|
||||||
@@ -0,0 +1,281 @@
|
|||||||
|
package com.betriebsratkanzlei.legalconsenthub_middleware.smartcard
|
||||||
|
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.CertificateDto
|
||||||
|
import com.betriebsratkanzlei.legalconsenthub_middleware_api.model.SmartCardInfoDto
|
||||||
|
import jakarta.annotation.PostConstruct
|
||||||
|
import org.apache.commons.exec.CommandLine
|
||||||
|
import org.apache.commons.exec.DefaultExecutor
|
||||||
|
import org.apache.commons.exec.PumpStreamHandler
|
||||||
|
import org.springframework.beans.factory.annotation.Value
|
||||||
|
import org.springframework.core.io.ResourceLoader
|
||||||
|
import org.springframework.stereotype.Service
|
||||||
|
import java.io.ByteArrayOutputStream
|
||||||
|
import java.io.File
|
||||||
|
import java.time.LocalDateTime
|
||||||
|
import java.util.*
|
||||||
|
import java.nio.file.Files
|
||||||
|
import java.nio.file.StandardCopyOption
|
||||||
|
|
||||||
|
@Service
|
||||||
|
class SmartCardService(
|
||||||
|
@Value("\${opensc.pkcs11.library.path}") private val openscPkcs11LibPath: String,
|
||||||
|
private val resourceLoader: ResourceLoader
|
||||||
|
) {
|
||||||
|
|
||||||
|
private lateinit var resolvedLibraryPath: String
|
||||||
|
|
||||||
|
@PostConstruct
|
||||||
|
fun init() {
|
||||||
|
resolvedLibraryPath = resolveLibraryPath()
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// macOS doesn't allow loading native libraries using classpath URLs. The library needs to be loaded from an absolute file path.
|
||||||
|
private fun resolveLibraryPath(): String {
|
||||||
|
val resource = resourceLoader.getResource(openscPkcs11LibPath)
|
||||||
|
if (!resource.exists()) {
|
||||||
|
throw IllegalStateException("PKCS11 library not found: $openscPkcs11LibPath")
|
||||||
|
}
|
||||||
|
|
||||||
|
val tempFile = Files.createTempFile("opensc-pkcs11", ".so").toFile()
|
||||||
|
tempFile.deleteOnExit()
|
||||||
|
|
||||||
|
resource.inputStream.use { input ->
|
||||||
|
Files.copy(input, tempFile.toPath(), StandardCopyOption.REPLACE_EXISTING)
|
||||||
|
}
|
||||||
|
|
||||||
|
tempFile.setExecutable(true)
|
||||||
|
tempFile.setReadable(true)
|
||||||
|
|
||||||
|
return tempFile.absolutePath
|
||||||
|
}
|
||||||
|
|
||||||
|
fun getSmartCardInfo(): SmartCardInfoDto {
|
||||||
|
val commandLine = CommandLine.parse("pkcs11-tool --module $resolvedLibraryPath --show-info")
|
||||||
|
val executor = DefaultExecutor()
|
||||||
|
val outputStream = ByteArrayOutputStream()
|
||||||
|
val errorStream = ByteArrayOutputStream()
|
||||||
|
|
||||||
|
executor.streamHandler = PumpStreamHandler(outputStream, errorStream)
|
||||||
|
|
||||||
|
return try {
|
||||||
|
val exitCode = executor.execute(commandLine)
|
||||||
|
|
||||||
|
if (exitCode == 0) {
|
||||||
|
val output = outputStream.toString()
|
||||||
|
parseSmartCardInfo(output)
|
||||||
|
} else {
|
||||||
|
val errorOutput = errorStream.toString()
|
||||||
|
throw SmartCardNotFoundException("No smart card detected: $errorOutput")
|
||||||
|
}
|
||||||
|
} catch (e: SmartCardNotFoundException) {
|
||||||
|
throw e
|
||||||
|
} catch (e: Exception) {
|
||||||
|
throw SmartCardReadException("Error reading smart card: ${e.message}", e)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fun getSmartCardCertificates(): List<CertificateDto> {
|
||||||
|
val commandLine = CommandLine.parse("pkcs11-tool --module $resolvedLibraryPath --list-objects --type cert")
|
||||||
|
val executor = DefaultExecutor()
|
||||||
|
val outputStream = ByteArrayOutputStream()
|
||||||
|
val errorStream = ByteArrayOutputStream()
|
||||||
|
|
||||||
|
executor.streamHandler = PumpStreamHandler(outputStream, errorStream)
|
||||||
|
|
||||||
|
return try {
|
||||||
|
val exitCode = executor.execute(commandLine)
|
||||||
|
|
||||||
|
if (exitCode == 0) {
|
||||||
|
val output = outputStream.toString()
|
||||||
|
parseCertificates(output)
|
||||||
|
} else {
|
||||||
|
val errorOutput = errorStream.toString()
|
||||||
|
throw SmartCardNotFoundException("No smart card detected or no certificates found: $errorOutput")
|
||||||
|
}
|
||||||
|
} catch (e: SmartCardNotFoundException) {
|
||||||
|
throw e
|
||||||
|
} catch (e: Exception) {
|
||||||
|
throw SmartCardReadException("Error reading smart card certificates: ${e.message}", e)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fun signHash(hash: String, certificateId: String): String {
|
||||||
|
val hashBytes = Base64.getDecoder().decode(hash)
|
||||||
|
|
||||||
|
val tempFile = File.createTempFile("hash_to_sign", ".bin")
|
||||||
|
|
||||||
|
return try {
|
||||||
|
tempFile.writeBytes(hashBytes)
|
||||||
|
|
||||||
|
// Build pkcs11-tool command to sign the hash (PIN will be prompted on device)
|
||||||
|
val commandLine =
|
||||||
|
CommandLine.parse("pkcs11-tool --module $resolvedLibraryPath --sign --mechanism RSA-PKCS --id $certificateId --input-file ${tempFile.absolutePath}")
|
||||||
|
|
||||||
|
val executor = DefaultExecutor()
|
||||||
|
val outputStream = ByteArrayOutputStream()
|
||||||
|
val errorStream = ByteArrayOutputStream()
|
||||||
|
|
||||||
|
executor.streamHandler = PumpStreamHandler(outputStream, errorStream)
|
||||||
|
|
||||||
|
val exitCode = executor.execute(commandLine)
|
||||||
|
|
||||||
|
if (exitCode == 0) {
|
||||||
|
val signature = outputStream.toByteArray()
|
||||||
|
Base64.getEncoder().encodeToString(signature)
|
||||||
|
} else {
|
||||||
|
val errorOutput = errorStream.toString()
|
||||||
|
throw RuntimeException("Failed to sign hash: $errorOutput")
|
||||||
|
}
|
||||||
|
} catch (e: Exception) {
|
||||||
|
throw RuntimeException("Error signing hash: ${e.message}", e)
|
||||||
|
} finally {
|
||||||
|
if (tempFile.exists()) {
|
||||||
|
tempFile.delete()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fun calculateHash(document: ByteArray, hashAlgorithm: String): String {
|
||||||
|
return try {
|
||||||
|
val javaHashAlgorithm = when (hashAlgorithm.uppercase()) {
|
||||||
|
"SHA1" -> "SHA-1"
|
||||||
|
"SHA256" -> "SHA-256"
|
||||||
|
"SHA384" -> "SHA-384"
|
||||||
|
"SHA512" -> "SHA-512"
|
||||||
|
else -> "SHA-256"
|
||||||
|
}
|
||||||
|
|
||||||
|
val messageDigest = java.security.MessageDigest.getInstance(javaHashAlgorithm)
|
||||||
|
val hashBytes = messageDigest.digest(document)
|
||||||
|
|
||||||
|
Base64.getEncoder().encodeToString(hashBytes)
|
||||||
|
} catch (e: Exception) {
|
||||||
|
throw RuntimeException("Error calculating hash: ${e.message}", e)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fun verifySignature(originalData: ByteArray, signature: String, certificateId: String, hashAlgorithm: String = "SHA256"): Boolean {
|
||||||
|
return try {
|
||||||
|
val signatureBytes = Base64.getDecoder().decode(signature)
|
||||||
|
|
||||||
|
// Calculate hash of the original data using the same algorithm that was used for signing
|
||||||
|
val hashBase64 = calculateHash(originalData, hashAlgorithm)
|
||||||
|
val hashBytes = Base64.getDecoder().decode(hashBase64)
|
||||||
|
|
||||||
|
val hashFile = File.createTempFile("hash_to_verify", ".bin")
|
||||||
|
val signatureFile = File.createTempFile("signature_to_verify", ".bin")
|
||||||
|
|
||||||
|
try {
|
||||||
|
hashFile.writeBytes(hashBytes)
|
||||||
|
signatureFile.writeBytes(signatureBytes)
|
||||||
|
|
||||||
|
// Verify against the hash, not the original document, since the signature was created from the hash
|
||||||
|
val verifyCommand = CommandLine.parse("pkcs11-tool --module $resolvedLibraryPath -m RSA-PKCS --verify --id $certificateId --input-file ${hashFile.absolutePath} --signature-file ${signatureFile.absolutePath}")
|
||||||
|
|
||||||
|
val executor = DefaultExecutor()
|
||||||
|
val outputStream = ByteArrayOutputStream()
|
||||||
|
val errorStream = ByteArrayOutputStream()
|
||||||
|
|
||||||
|
executor.streamHandler = PumpStreamHandler(outputStream, errorStream)
|
||||||
|
val exitCode = executor.execute(verifyCommand)
|
||||||
|
|
||||||
|
if (exitCode == 0) {
|
||||||
|
println("Signature verification successful")
|
||||||
|
true
|
||||||
|
} else {
|
||||||
|
println("Signature verification failed: ${errorStream.toString()}")
|
||||||
|
false
|
||||||
|
}
|
||||||
|
|
||||||
|
} finally {
|
||||||
|
if (hashFile.exists()) hashFile.delete()
|
||||||
|
if (signatureFile.exists()) signatureFile.delete()
|
||||||
|
}
|
||||||
|
} catch (e: Exception) {
|
||||||
|
println("Error during signature verification: ${e.message}")
|
||||||
|
// If any error occurs during verification, consider it invalid
|
||||||
|
false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private fun parseSmartCardInfo(output: String): SmartCardInfoDto {
|
||||||
|
val lines = output.split("\n")
|
||||||
|
var label = "Unknown"
|
||||||
|
var serialNumber: String? = null
|
||||||
|
var manufacturer: String? = null
|
||||||
|
var model: String? = null
|
||||||
|
|
||||||
|
for (line in lines) {
|
||||||
|
when {
|
||||||
|
line.contains("Token label") -> {
|
||||||
|
label = line.split(":").getOrNull(1)?.trim() ?: "Unknown"
|
||||||
|
}
|
||||||
|
|
||||||
|
line.contains("Serial number") -> {
|
||||||
|
serialNumber = line.split(":").getOrNull(1)?.trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
line.contains("Manufacturer") -> {
|
||||||
|
manufacturer = line.split(":").getOrNull(1)?.trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
line.contains("Model") -> {
|
||||||
|
model = line.split(":").getOrNull(1)?.trim()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return SmartCardInfoDto(
|
||||||
|
isPresent = true,
|
||||||
|
label = label,
|
||||||
|
serialNumber = serialNumber,
|
||||||
|
manufacturer = manufacturer,
|
||||||
|
model = model
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
private fun parseCertificates(output: String): List<CertificateDto> {
|
||||||
|
val certificates = mutableListOf<CertificateDto>()
|
||||||
|
val lines = output.split("\n")
|
||||||
|
|
||||||
|
// This is a simplified parser - in reality, you'd need more sophisticated parsing
|
||||||
|
var currentId: String? = null
|
||||||
|
var currentLabel: String? = null
|
||||||
|
|
||||||
|
for (line in lines) {
|
||||||
|
when {
|
||||||
|
line.contains("Certificate Object") -> {
|
||||||
|
currentId = UUID.randomUUID().toString()
|
||||||
|
currentLabel = null
|
||||||
|
}
|
||||||
|
|
||||||
|
line.contains("label:") -> {
|
||||||
|
currentLabel = line.split(":").getOrNull(1)?.trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
line.contains("ID:") -> {
|
||||||
|
val id = line.split(":").getOrNull(1)?.trim()
|
||||||
|
if (currentId != null && currentLabel != null) {
|
||||||
|
certificates.add(createCertificateDto(currentLabel, id))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return certificates
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO: Replace with actual certificate parsing logic
|
||||||
|
private fun createCertificateDto(label: String, keyId: String?): CertificateDto {
|
||||||
|
return CertificateDto(
|
||||||
|
id = keyId ?: "",
|
||||||
|
subject = label,
|
||||||
|
issuer = "Unknown Issuer",
|
||||||
|
validFrom = LocalDateTime.now().minusYears(1),
|
||||||
|
validTo = LocalDateTime.now().plusYears(3),
|
||||||
|
keyUsage = listOf("digitalSignature", "keyEncipherment"),
|
||||||
|
fingerprint = "Unknown"
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
spring:
|
||||||
|
application:
|
||||||
|
name: legalconsenthub-middleware
|
||||||
|
servlet:
|
||||||
|
multipart:
|
||||||
|
max-file-size: 10MB
|
||||||
|
max-request-size: 10MB
|
||||||
|
|
||||||
|
server:
|
||||||
|
port: 8081
|
||||||
|
servlet:
|
||||||
|
context-path: /
|
||||||
|
|
||||||
|
logging:
|
||||||
|
level:
|
||||||
|
com.betriebsratkanzlei.legalconsenthub_middleware: DEBUG
|
||||||
|
org.springframework.security: DEBUG
|
||||||
|
|
||||||
|
#springdoc:
|
||||||
|
# api-docs:
|
||||||
|
# path: /v3/api-docs
|
||||||
|
# swagger-ui:
|
||||||
|
# path: /swagger-ui.html
|
||||||
|
# operationsSorter: method
|
||||||
|
|
||||||
|
opensc:
|
||||||
|
pkcs11:
|
||||||
|
library:
|
||||||
|
path: classpath:binaries/opensc-pkcs11.so
|
||||||
BIN
legalconsenthub-middleware/src/main/resources/binaries/opensc-pkcs11.so
Executable file
BIN
legalconsenthub-middleware/src/main/resources/binaries/opensc-pkcs11.so
Executable file
Binary file not shown.
Reference in New Issue
Block a user